trying to get 2 different lines one for HDX and the other for RDP, can anyone help please?
Try replacing the last stats command with timechart.
| timechart count by protocol
Try
| chart count by _time protocol